CVE-2026-49278— Rocket.Chat: Livechat Visitor Profile Disclosure Leaks Bearer Token and Enables Visitor Impersonation
Possible ATT&CK Techniques 1AI
T1005 · Data from Local SystemAffected Version Matrix 8
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| RocketChat | Rocket.Chat | >= 8.5.0-rc.0, < 8.5.0 | affected |
>= 8.4.0-rc.0, < 8.4.2 | affected | ||
>= 8.3.0-rc.0, < 8.3.4 | affected | ||
>= 8.2.0-rc.0, < 8.2.4 | affected | ||
>= 8.1.0-rc.0, < 8.1.5 | affected | ||
>= 8.0.0-rc.0, < 8.0.6 | affected | ||
>= 7.11.0-rc.0, < 7.13.8 | affected | ||
< 7.10.12 | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-49278
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Rocket.Chat: Livechat Visitor Profile Disclosure Leaks Bearer Token and Enables Visitor Impersonation
Source: NVD (National Vulnerability Database)
Vulnerability Description
Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 8.5.0, 8.4.2, 8.3.4, 8.2.4, 8.1.5, 8.0.6, 7.13.8, and 7.10.12, in the visitors.info endpoint, https://developer.rocket.chat/apidocs/get-visitor-information-by-id-1, token is returned in the response. It looks like there's no use case for the token to be present in the response and it would be a good security practice to remove it altogether. This vulnerability is fixed in 8.5.0, 8.4.2, 8.3.4, 8.2.4, 8.1.5, 8.0.6, 7.13.8, and 7.10.12.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L
Source: NVD (National Vulnerability Database)
Vulnerability Type
授权机制不恰当
Source: NVD (National Vulnerability Database)
Vulnerability Title
Rocket.Chat 授权问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
RocketChat rocket.chat是巴西RocketChat公司开源的一款团队协作即时通讯平台。 Rocket.Chat存在授权问题漏洞，该漏洞源于在visitors.info端点返回的响应中包含token，可能导致授权问题。以下版本受到影响：8.5.0之前版本、8.4.2之前版本、8.3.4之前版本、8.2.4之前版本、8.1.5之前版本、8.0.6之前版本、7.13.8之前版本和7.10.12之前版本。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| RocketChat | Rocket.Chat | >= 8.5.0-rc.0, < 8.5.0 | - |
II. Public POCs for CVE-2026-49278
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-49278
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-49278 (1)
Same Patch Batch · RocketChat · 2026-06-24 · 12 CVEs total
| CVE-2026-45688 | 9.1 CRITICAL | Rocket.Chat: Pre-Auth NoSQL Injection in CAS Login Handler leading to Arbitrary CAS/SAML U |
| CVE-2026-45689 | 9.1 CRITICAL | Rocket.Chat: Pre-Auth NoSQL Injection in OAuth2 Token Endpoint leading to Arbitrary User A |
| CVE-2026-45687 | 8.5 HIGH | Rocket.Chat: Authenticated Arbitrary Data Export Theft via Mass Assignment in sendFileMess |
| CVE-2026-55762 | 8.1 HIGH | Rocket.Chat: Any Authenticated User Can Permanently Deregister Workspace from Rocket.Chat |
| CVE-2026-55759 | 7.4 HIGH | Rocket.Chat: Apple Sign-In skips JWT claims validation, allowing expired and cross-audienc |
| CVE-2026-47733 | 4.4 MEDIUM | Rocket.Chat: Missing URL protocol sanitization in ImageElement allows javascript: URLs in |
| CVE-2026-45677 | Rocket.Chat: Lack of SAML Signature Check During Logout Could Lead To DoS | |
| CVE-2026-45757 | Rocket.Chat: users.deactivateIdle` deactivates accounts without revoking existing login to | |
| CVE-2026-49277 | Rocket.Chat: OAuth access and refresh tokens remain valid after account deactivation | |
| CVE-2026-46423 | Rocket.Chat: SAML signature validation skipped when IdP certificate field is empty | |
| CVE-2026-55666 | Rocket.Chat: Email Parameter Fallback Leads To Account Takeover Within Apple OAuth |
IV. Related Vulnerabilities
Same product: Rocket.Chat
- CVE-2026-55762
Rocket.Chat: Any Authenticated User Can Permanently Deregist - CVE-2026-55759
Rocket.Chat: Apple Sign-In skips JWT claims validation, allo - CVE-2026-55666
Rocket.Chat: Email Parameter Fallback Leads To Account Takeo - CVE-2026-49277
Rocket.Chat: OAuth access and refresh tokens remain valid af - CVE-2026-45757
Rocket.Chat: users.deactivateIdle` deactivates accounts with
Same vendor: RocketChat
- CVE-2026-55762
Rocket.Chat: Any Authenticated User Can Permanently Deregist - CVE-2026-55759
Rocket.Chat: Apple Sign-In skips JWT claims validation, allo - CVE-2026-55666
Rocket.Chat: Email Parameter Fallback Leads To Account Takeo - CVE-2026-49277
Rocket.Chat: OAuth access and refresh tokens remain valid af - CVE-2026-45757
Rocket.Chat: users.deactivateIdle` deactivates accounts with
Same weakness: CWE-285
- CVE-2026-56240
Capgo - Billing Authorization Bypass via Exhausted Usage Cre - CVE-2026-15377
Eleveo Call Recording Software sendlogfile improper authoriz - CVE-2026-15376
Eleveo Call Recording Software statisticReportAction.do impr - CVE-2026-15375
Eleveo Call Recording Software LDAP User users_ldap.jsp impr - CVE-2026-15374
Eleveo Call Recording Software Group roleAddAction.do improp
V. Comments for CVE-2026-49278
No comments yet